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Abstract 

We present a number of results related to quantum al- 
gorithms with small error probability and quantum algo- 
rithms that are zero-error. First, we give a tight analysis 
of the trade-offs between the number of queries of quantum 
search algorithms, their error probability, the size of the 
search space, and the number of solutions in this space. Us- 
ing this, we deduce new lower and upper bounds for quan- 
tum versions of amplification problems. Next, we establish 
nearly optimal quantum-classical separations for the query 
complexity of monotone functions in the zero-error model 
(where our quantum zero-error model is defined so as to 
be robust when the quantum gates are noisy). Also, we 
present a communication complexity problem related to a 
total function for which there is a quantum-classical com- 
munication complexity gap in the zero-error model. Finally, 
we prove separations for monotone graph properties in the 
zero-error and other error models which imply that the eva- 
siveness conjecture for such properties does not hold for 
quantum computers. 



1 Motivation and summary of results 

A general goal in the design of randomized algorithms 
is to obtain fast algorithms with small error probabilities. 
Along these lines is also the goal of obtaining fast algo- 
rithms that are zero-error (a.k.a. Las Vegas), as opposed 
to bounded-error (a.k.a. Monte Carlo). We examine these 
themes in the context of quantum algorithms, and present a 
number of new upper and lower bounds that contrast with 
those that arise in the classical case. 

The error probabilities of many classical probabilistic al- 
gorithms can be reduced by techniques that are commonly 
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referred to as amplification. For example, if an algorithm 
A that errs with probability < | is known, then an error 
probability bounded above by an arbitrarily small e > 
can be obtained by running A independently 0(log(l/e)) 
times and taking the majority value of the outcomes. This 
amplification procedure increases the running time of the 
algorithm by a multiplicative factor of 0(log(l/e)) and is 
optimal (assuming that A is only used as a black-box). We 
first consider the question of whether or not it is possible to 
perform amplification more efficiently on a quantum com- 
puter. 

A classical probabilistic algorithm A is said to (p, q)- 
compute a function / : {0, 1}* — ► {0, 1} if 



Pr[A(x) = 1] 



<P 

>q 



if f(x) = 
i£f(x) = l. 



Algorithm A can be regarded as a deterministic algorithm 
with an auxiliary input 7-, which is uniformly distributed 
over some underlying sample space S (usually S is of the 
form {0, We will focus our attention on the one- 
sided-error case (i.e. when p — 0) and prove bounds on 
quantum amplification by translating them to bounds on 
quantum search. In this case, for any x £ {0, 1}", f(x) = 1 
ffi(3r£S)(A(x,r) = l). 

Graver's quantum search algorithm [|l5|| (and some re- 
finements of it [g |, |§ |9[ 0) can be cast as a quantum 
amplification method that is provably more efficient than 
any classical method. It amplifies a (0, q) -algorithm to a 
(0, |) -quantum-computer with 0(1/ ^/q) executions of A, 
whereas classically Q(l/q) executions of A would be re- 
quired to achieve this. It is natural to consider other ampli- 
fication problems, such as amplifying (0, g) -computers to 
(0, 1 — e) -quantum-computers (0 < q < 1 — e < 1). We 
give a tight analysis of this. 

Theorem 1 Let A : {0, 1}™ x S — > {0, 1} be a classical 
probabilistic algorithm that (0, q)-computes some function 
f, and let N — \S\ and e > 2~ N . Then, given a black- 
box for A, the number of calls to A that are necessary and 
sufficient to (0, 1 — e)-quantum-compute f is 



(1) 



e CVn (yiog(i/£) + q N - v^v 



The lower bound is proven via the polynomial 
method [ 3 1 3[j and with adaptations of techniques from [ [32[ 
[Tl| ] . The upper bound is obtained by a combination of ideas, 
including repeated calls to an exact quantum search algo- 
rithm for the special case where the exact number of solu- 
tions is known [|7| pj. 

From Theorem]!] we deduce that amplifying (0, |) clas- 
sical computers to (0, 1 — e) quantum computers requires 
0(log(l/e)) executions, and hence cannot be done more 
efficiently in the quantum case than in the classical case. 
These bounds also imply a remarkable algorithm for ampli- 
fying a classical (0, -^-computer A to a (0, 1 — e) quan- 
tum computer. Note that if we follow the natural approach 
of composing an optimal (0, -^) — > (0, 4) amplifier with 
an optimal (0, ^) — > (0, 1 — e) amplifier then our ampli- 
fier makes Q(y/~N log(l/e)) calls to A. On the other hand, 
Theorem 1 shows that, in the case where N = \S\, there is 
a more efficient (0, ^) — > (0, 1 — e) amplifier that makes 
only Q(y / N\og(l/e)) calls to A (and this is optimal). 

Next we turn our attention to the zero-error (Las Vegas) 
model. A zero-error algorithm never outputs an incorrect 
answer but it may claim ignorance (output 'inconclusive') 
with probability < 1/2. Suppose we want to compute some 
function / : {0, 1} N -> {0, 1}. The input x € {0, 1}^ can 
only be accessed by means of queries to a black-box which 
returns the ith bit of x when queried on i. Let D(f) denote 
the number of variables that a deterministic classical algo- 
rithm needs to query (in the worst case) in order to compute 
/, i?o(/) the number of queries for a zero-error classical 
algorithm, and i?2(/) for bounded-error. There is a mono- 
tone function g with R (g) e Q (D(g) - 753 -) @ 
and it is known that Ro(f) > \J D(f) for any function 
/ [Q, [l8||. It is a longstanding open question whether 
Ro(f) > \J D(f) is tight. We solve the analogous ques- 
tion for monotone functions for the quantum case. 

Let Qe (/), Qa (/), Q2 (f) respectively be the number of 
queries that an exact, zero-error, or bounded-error quantum 
algorithm must make to compute /. For zero-error quan- 
tum algorithms, there is an issue about the precision with 
which its gates are implemented: any slight imprecisions 
can reduce an implementation of a zero-error algorithm to a 
bounded-error one. We address this issue by requiring our 
zero-error quantum algorithms to be self-certifying in the 
sense that they produce, with constant probability, a certifi- 
cate for the value of / that can be verified by a classical al- 
gorithm. As a result, the algorithms remain zero-error even 
with imperfect quantum gates. The number of queries is 
then counted as the sum of those of the quantum algorithm 
(that searches for a certificate) and the classical algorithm 
(that verifies a certificate). Our upper bounds for Qo(f) 
will all be with self-certifying algorithms. 

We first show that Qo(f) > wD[f) for every monotone 
f (even without the self-certifying requirement). Then we 



exhibit a family of monotone functions that nearly achieves 
this gap: for every e > Owe construct a g such that Qo(g) € 
O(D(g) - 5+E ). In fact even Q (g) e 0{R 2 (g) a - 5+e ). 
These g are so-called "AND-OR-trees". They are the first 
examples of functions / : {0,1}^ — > {0,1} whose quan- 
tum zero-error query complexity is asymptotically less than 
their classical zero-error or bounded-error query complex- 
ity. It should be noted that Qo(OR) = N so the 
quadratic speedup from Graver's algorithm is lost when 
zero-error performance is required. 

Furthermore, we apply the idea behind the above zero- 
error quantum algorithms to obtain a new result in commu- 
nication complexity. We derive from the AND-OR-trees a 
communication complexity problem where an asymptotic 
gap occurs between the zero-error quantum communica- 
tion complexity and the zero-error classical communica- 
tion complexity (there was a previous example of a zero- 
error gap for a function with restricted domain in [^] and 
bounded-error gaps in [^, [33j]). This result includes a new 
lower bound in classical communication complexity. We 
also state a result by Hartmut Klauck, inspired by an ear- 
lier version of this paper, which gives the first total function 
with quantum-classical gap in the zero-error model of com- 
munication complexity. 

Finally, a class of black-box problems that has received 
wide attention concerns the determination of monotone 
graph properties [[35] ^2|, Q [l7|]. Consider a directed graph 
on n vertices. It has n(n — 1) possible edges and hence 
can be represented by a black -box of n(n — 1) binary vari- 
ables, where each variable indicates whether or not a spe- 
cific edge is present. A nontrivial monotone graph prop- 
erty is a property of such a graph (i.e. a function P : 
{0, l}"( n_1 ) — > {0, 1}) that is non-constant, invariant un- 
der permutations of the vertices of the graph, and mono- 
tone. Clearly, n(n — 1) is an upper bound on the num- 
ber of queries required to compute such properties. The 
Aanderaa-Karp-Rosenberg or evasiveness conjecture states 
that D(P) = n(n — 1) for all P. The best known general 
lower bound is f2(n 2 ) [ [35], p2[ 53]. It has also been conjec- 
tured that Ro(P) € din 2 ) for all P, but the current best 
bound is only il (n 4 / 3 ) jl7[|. A natural question is whether 
or not quantum algorithms can determine monotone graph 
properties more efficiently. We show that they can. Firstly, 
in the exact model we exhibit a P with Qe{P) < n ( n — 1)> 
so the evasiveness conjecture fails in the case of quantum 
computers. However, we also prove Qe(P) G ft(n 2 ) for 
all P, so evasiveness does hold up to a constant factor for 
exact quantum computers. Secondly, we give a nontrivial 
monotone graph property for which the evasiveness con- 
jecture is violated by a zero-error quantum algorithm: let 
STAR be the property that the graph has a vertex which is 
adjacent to all other vertices. Any classical (zero-error or 
bounded-error) algorithm for STAR requires VL{n 2 ) queries. 



We give a zero-error quantum algorithm that determines 
STAR with only 0(n 3 / 2 ) queries. Finally, for bounded- 
error quantum algorithms, the OR problem trivially trans- 
lates into the monotone graph property "there is at least one 
edge", which can be determined with only 0(n) queries via 
Graver's algorithm J15[], 

2 Basic definitions and terminology 

See [Q, [3|] for details and references for the quantum cir- 
cuit model. For b £ {0, 1}, a query gate O for an input 
x = (xo, . . . ,a;jv_i) £ {0, 1}^ performs the following 
mapping, which is our only way to access the bits xf 

\j,b) \j,b®x j ). 

We sometimes use the term "black-box" for x as well as 
O. A quantum algorithm or gate network A with T queries 
is a unitary transformation A — UtOUt-iO . . . OU\OUo- 
Here the Ui are unitary transformations that do not depend 
on x. Without loss of generality we fix the initial state to 
|0), independent of x. The final state is then a superposition 
A|0) which depends on x only via the T query gates. One 
specific qubit of the final state (the rightmost one, say) is 
designated for the output. The acceptance probability of a 
quantum network on a specific black-box x is defined to be 
the probability that the output qubit is 1 (if a measurement 
is performed on the final state). 

We want to compute a function / : {0, 1}^ — > {0, 1}, 
using as few queries as possible (on the worst-case input). 
We distinguish between three different error-models. In the 
case of exact computation, an algorithm must always give 
the correct answer f(x) for every x. In the case of bounded- 
error computation, an algorithm must give the correct an- 
swer / (x) with probability > 2/3 for every x. In the case of 
zero-error computation, an algorithm is allowed to give the 
answer 'don't know' with probability < 1/2, but if it out- 
puts an answer (0 or 1), then this must be the correct answer. 
The complexity in this zero-error model is equal up to a fac- 
tor of 2 to the expected complexity of an optimal algorithm 
that always outputs the correct answer. Let D(f), Ro(f), 
and i?2(/) denote the exact, zero-error and bounded-error 
classical complexities, respectively, and Qe(I), Qo(/)> 
Q2H) be the corresponding quantum complexities. Note 
that TV > D(f) > QeU) > Qo(f) > Q2U) and 
N > £>(/) > R (f) > R 2 (f) > Q 2 (f) for every /. 

3 Tight trade-offs for quantum searching 

In this section, we prove Theorem [IJ stated in Section [j]. 
The search problem is the following: for a given black-box 
x, find a j such that Xj = 1 using as few queries to x as 



possible. A quantum computer can achieve error probabil- 
ity < 1/3 using T £ Q(VN) queries [jl^]. We address the 
question of how large the number of queries should be in 
order to be able to achieve a very small error e. We will 

prove that if T < N, then T £ 9 (^A/Vlog^/e)) . This 
result will actually be a special case of a more general the- 
orem that involves a promise on the number of solutions. 
Suppose we want to search a space of N items with error 
e, and we are promised that there are at least some number 
t < N solutions. The higher t is, the fewer queries we will 
need. In the appendix we give the following lower bound 
on e in terms of T, using tools from |3^, [IT]] . 

Theorem 2 Under the promise that the number of solutions 
is at least t, every quantum search algorithm that uses T < 
N — t queries has error probability 

E£fl ( e -4bT 2 /(N-t)-8Ty/tN/(N-t)A _ 

Here b is a positive universal constant. This theorem im- 
plies a lower bound on T in terms of e. To give a tight 
characterization of the relations between T, N, t and e, we 
need the following upper bound on T for the case t = 1: 

Theorem 3 For every e > there exists a quan- 
tum search algorithm with error probability < e and 

O ^y/ 'N log(l / e)^ queries. 

Proof Set t = ri°g(l/ e )l- Consider the following algo- 
rithm: 

1. Apply exact search for t = 1, . . . ,to, each of which 
takes 0(y/N/t) queries. 

2. If no solution has been found, then conduct to 
searches, each with 0(y/N/to) queries. 

3. Output a solution if one has been found, otherwise out- 
put 'no'. 

The query complexity of this algorithm is bounded by 

If the real number of solutions was in {1, . . . , to}, then a 
solution will be found with certainty in step 1 . If the real 
number of solutions was > to, then each of the searches in 
step 2 can be made to have error probability < 1/2, so we 
have total error probability at most (1/2)*° < e. □ 

A more precise analysis gives T < 2.45 v /A r log(l/e). It 
is interesting that we can use this to prove something about 



the constant b of the Coppersmith-Rivlin theorem (see ap- 
pendix): for t — 1 and e E o(l), the lower bound asymptot- 
ically becomes T > ^ N log(l/e)/46. Together these two 
bounds imply b > l/4(2.45) 2 « 0.042. 

The main theorem of this section tightly characterizes 
the various trade-offs between the size of the search space 
N, the promise t, the error probability e, and the required 
number of queries: 

Theorem 4 Fix 77 <E (0, 1), and let N > 0, s > 2~ N , 
and t < r)N. Let T be the optimal number of queries a 
quantum computer needs to search with error < e through 
an unordered list of N items containing at least t solutions. 
Then 

( T 2 FT\ 

iog(i/ £ ) e e^- + ^/-j. 

Proof From Theorem || we obtain the upper bound 

(t 2 FT\ 

log(l/e) € ^("/v^^Vtv)'^ P rOV6 a ' owel bound 

on log(l/e) we distinguish two cases. 

Case 1: T > y/tN. By Theorem^ we can achieve error 
< e using T u G 0(V ' N\og(l/e)) queries. Now (leaving 
out some constant factors): 

logd/e) > ^ > I (H + T*) > i ( T - +T JT] 
By/J -N-2\N NJ~2yN \INJ 

Case 2: T < y/tN. We can achieve error < 1/2 us- 
ing 0{yjN/t) queries, and then classically amplify this 
to error < 1/e using 0(log(l/e)) repetitions. This takes 
T u £ 0{^N/t log(l/e)) queries in total. Now: 




□ 



Rewriting Theorem f| (with q = t/N) yields the general 
bound of Theorem |l[ 

For t = 1 this becomes T e 6(y / iV log(l/e)). Thus no 
quantum search algorithm with 0(vN) queries has error 
probability o(l). Also, a quantum search algorithm with 
e < 2~ N needs fl(N) queries. For the case e = 1/3 we 
re-derive the bound 9 ( y/N/t) from [^] . 

4 Applications of Theorem 1 to amplification 

In this section we apply the bounds from Theorem [j] to 
examine the speedup possible for amplifying classical one- 
sided error algorithms via quantum algorithms. Observe 



that searching for items in a search space of size N and fig- 
uring out whether a probabilistic one-sided error algorithm 
A with sample space S of size TV accepts are essentially the 
same thing. 

Let us analyze some special cases more closely. Sup- 
pose that we want to amplify an algorithm A that (0, i)- 
computes some function / to (0, 1 — e). Then substituting 
\S\ = N and q = | into Eq. (jl|) in Theorem [j] yields 

Theorem 5 Let A : {0, 1}" x S — > {0, 1} be a classical 
probabilistic algorithm that (0, ^-computes some function 
f, and e > 2~' s l Then, given a black-box for A, the num- 
ber of calls to A that any quantum algorithm needs to make 
to (0, 1 — e)-compute f is f2(log(l/e)). 

Hence amplification of one-sided error algorithms with 
fixed initial success probability cannot be done more effi- 
ciently in the quantum case than in the classical case. Since 
one-sided error algorithms are a special case of bounded- 
error algorithms, the same lower bound also holds for 
amplification of bounded-error algorithms. A similar but 
slightly more elaborate argument as above shows that a 
quantum computer still needs fi(log(l/e)) applications of 
A when A is zero-error. 

Some other special cases of Theorem |IJ in order to am- 
plify a (0, -^-computer A to a (0, i)-computer, 9(\/iV) 
calls to A are necessary and sufficient (and this is essen- 
tially a restatement of known results of Grover and others 
about quantum searching [|l5[ ^]). Also, in order to am- 
plify a (0, -^-computer with sample space of size N to a 
(0, 1 — e)-computer, Q(^/N log(l/e)) calls to A are neces- 
sary and sufficient. 

Finally, consider what happens if the size of the sam- 
ple space is unknown and we only know that A is a clas- 
sical one-sided error algorithm with success probability q. 
Quantum amplitude amplification can improve the success 
probability to 1/2 using 0(1/ ^fq) repetitions of A. We can 
then classically amplify the success probability further to 
1 — e using 0(log(l/e)) repetitions. In all, this method uses 
0(log(l/ e) / y/q) applications of A. Theorem || implies that 
this is best possible in the worst case (i.e. if A happens to 
be a classical algorithm with very large sample space). 

5 Zero-error quantum algorithms 

In this section we consider zero-error complexity of 
functions in the query (a.k.a. black-box) setting. The best 
general bound that we can prove between the quantum zero- 
error complexity Qo(/) and the classical deterministic com- 
plexity D(f) for total functions is the following (the proof 
is similar to the D(f) £ 0(QE{f) i ) result given in [||] and 
uses an unpublished proof technique of Nisan and Smolen- 
sky): 



Theorem 6 For every total function f we have D(f) G 
0(Qo(/) 4 )- 

We will in particular look at monotone increasing f. 
Here the value of / cannot flip from 1 to if more variables 
are set to 1. For such /, we improve the bound to: 

Theorem 7 For every total monotone Boolean function f 
we have D(f) < Qa(f) 2 . 

Proof Let s(f) be the sensitivity of /: the maximum, over 
all x, of the number of variables that we can individually flip 
in x to change f(x). Let x be an input on which the sensi- 
tivity of / equals s(f). Assume without loss of generality 
that f(x) = 0. All sensitive variables must be in x, and 
setting one or more of them to 1 changes the value of / from 
to 1 . Hence by fixing all variables in x except for the s(/) 
sensitive variables, we obtain the OR function on s(f) vari- 
ables. Since OR on s(f) variables has Q (OR) = s(f) [§, 
Proposition 6.1], it follows that s(f) < Qo(/)- It is known 
(see for instance p0| , ||) that D(f) < s(f) 2 for monotone 
/, hence D(f) <Q (f) 2 . □ 

Important examples of monotone functions are AND-OR 
trees. These can be represented as trees of depth d where 
the N leaves are the variables, and the d levels of internal 
nodes are alternatingly labeled with ANDs and ORs. Using 
techniques from it is easy to show that Qe{J) > N/2 
and D(f) = N for such trees. However, we show that in 
the zero-error setting quantum computers can achieve sig- 
nificant speed-ups for such functions. These are in fact the 
first total functions with superlinear gap between quantum 
and classical zero-error complexity. Interestingly, the quan- 
tum algorithms for these functions are not just zero-error: 
if they output an answer b £ {0,1} then they also output 
a b-certificate for this answer. This is a set of indices of 
variables whose values force the function to the value b. 

We prove that for sufficiently large d, quantum comput- 
ers can obtain near-quadratic speed-ups on d-level AND- 
OR trees which are uniform, i.e. have branching factor 
jyi/d a j g^jj i eve i Using the next lemma (which is proved 
in the appendix) we show that Theorem ^ is almost tight: 
for every e > there exists a total monotone / with 
Qo(/) e O(N^). 

Lemma 1 Let d > 1 and let f denote the uniform d-level 
AND-OR tree on N variables that has an OR as root. There 
exists a quantum algorithm A\ that finds a 1 -certificate in 
expected number of queries 0(N 1 / 2+1 / 2d ) if f(x) = 1 and 
does not terminate if f(x) = 0. Similarly, there exists a 
quantum algorithm Aq that finds a O-certificate in expected 
number of queries 0(N 1 ^ 2+1 ^ d ) if fix) — and does not 
terminate if f(x) = 1. 



Theorem 8 Let d > 1 and let f denote the uniform d-level 
AND-OR tree on N variables that has an OR as root. Then 
Qo(f) G 0(J\rVa+V*) andR 2 (f) G Q(N). 

Proof Run the algorithms A\ and A$ of Lemma [j] side- 
by-side until one of them terminates with a certificate. This 
gives a certificate-finding quantum algorithm for / with ex- 
pected number of queries (3(iV 1 / 2+1 / d ). Run this algorithm 
for twice its expected number of queries and answer 'don't 
know' if it hasn't terminated after that time. By Markov's 
inequality, the probability of non-termination is < 1/2, 
so we obtain an algorithm for our zero-error setting with 
Qo(f) G 0(A^ 1/2+1/d ) queries. 

The classical lower bound follows from combining two 
known results. First, an AND-OR tree of depth d on N vari- 
ables has Ro(f) > N/2 d [|20[ Theorem 2.1] (see also Q). 
Second, for such trees we have R 2 (f) £ Q(i? (/)) |39|. 
Hence R 2 (f) G fi(JV). □ 

This analysis is not quite optimal. It gives only trivial 
bounds for d = 2, but a more refined analysis shows that 
we can also get speed-ups for such 2-level trees: 

Theorem 9 Let f be the AND of N 1 ' 3 ORs of N 2 ' 3 vari- 
ables each. Then Q (f) £ Q(N 2 / 3 ) and R 2 {j) £ Cl{N). 

Proof A similar analysis as before shows Qo(f) G 
0{N 2 / 3 ) and R 2 (f) G Cl(N). 

For the quantum lower bound: note that if we set all vari- 
ables to 1 except for the N 2 / 3 variables in the first subtree, 
then / becomes the OR of N 2 ^ 3 variables. This is known 
to have zero-error complexity exactly N 2 / 3 ^ Proposi- 
tion 6.1], hence Q (f) £ n(N 2 / 3 ). □ 



If we consider a tree with v N subtrees of v N variables 
each, we would get Q (f) £ 0(iV 3/4 ) mdR 2 (f) £ Sl(N). 
The best lower bound we can prove here is Qo(f) £ 
fi(y/N). However, if we also require the quantum algo- 
rithm to output a certificate for /, we can prove a tight quan- 
tum lower bound of Q(N 3 / 4 ). We do not give the proof 
here, which is a technical and more elaborate version of the 
proof of the classical lower bound of Theorem |Io|. 

6 Zero-error communication complexity 

The results of the previous section can be translated to 
the setting of communication complexity [[26]]. Here there 
are two parties, Alice and Bob, who want to compute some 
relation R C {0, 1} W x {0, 1}^ x {0, 1} M . Alice gets input 
x £ {0, 1}^ and Bob gets input y £ {0, 1}^. Together they 
want to compute some z £ {0, 1} M such that (x, y, z) £ R, 
exchanging as few bits of communication as possible. The 
often studied setting where Alice and Bob want to compute 



some function / : {0, 1} N x {0, 1} N -> {0, 1} is a spe- 
cial case of this. In the case of quantum communication, 
Alice and Bob can exchange and process qubits, potentially 
giving them more power than classical communication. 

Let g : {0, 1}^ -> {0, 1} be one of the AND-OR-trees 
of the previous section. We can derive from this a com- 
munication problem / : {0, 1}^ x {0, 1}^ ->■ {0, 1} by 
defining f(x, y) = g(x A y), where x A y € {0, 1}^ is the 
vector obtained by bitwise AND-ing Alice's x and Bob's 
y. Let us call such a problem a "distributed" AND-OR- 
tree. Buhrman, Cleve, and Wigderson [||] show how to turn 
a T-query quantum black-box algorithm for g into a com- 
munication protocol for / with 0(T log N) qubits of com- 
munication. Thus, using the upper bounds of the previous 
section, for every e > 0, there exists a distributed AND- 
OR-tree / that has a 0(A fl / 2+£ )-qubit zero-error protocol. 
It is conceivable that the classical zero-error communica- 
tion complexity of these functions is lu(N 1 / 2+e ); however, 
we are not able to prove such a lower bound at this time. 
Nevertheless, we are able to establish a quantum-classical 
separation for a relation that is closely related to the AND- 
OR-tree functions, which is explained below. 

For any AND-OR tree function g : {0, 1}^ -► {0, 1} 
and input x 6 {0, 1}^, a certificate for the value of g on 
input x is a subset c of the indices {0, 1, . . . , N — 1} such 
that the values {xi : i <G c] determine the value of g(x). It 
is natural to denote c as an element of {0, 1}^, representing 
the characteristic function of the set. For example, for 

g(x , xi,x 2 ,xs) = (x V xi) A (x 2 V x 3 ), (2) 

a certificate for the value of g on input x — 1011 is c = 
1001, which indicates that xq = 1 and £3 = 1 determine 
the value of g. 

We can define a communication problem based on find- 
ing these certificates as follows. For any AND-OR tree 
function g : {Q,l} N -> {0, 1} and x, y e {0,1}^, a 
certificate for the value of g on distributed inputs x and 
y is a subset c of {0, 1, . . . , N — 1} (denoted as an ele- 
ment of {0, 1}^) such that the values {(xi,yi) : i E c} 
determine the value of g(x A y). Define the relation R C 
{0, 1} N x {0, 1} N x {0, 1}^ such that (x, y,c) £ R iff 
c is a certificate for the value of g on distributed inputs x 
and y. For example, when R is with respect to the func- 
tion g of equation (§), (1011, 1111, 1001) € R, because, 
for x = 1011 and y = 1111, an appropriate certificate is 
c=1001. 

The zero-error certificate-finding algorithm for g of the 
previous section, together with the [^-translation from 
black-box algorithms to communication protocols, implies 
a zero-error quantum communication protocol for R. Thus, 
Theorem [| implies that for every e > there exists a rela- 
tion R C {0, 1}^ x {0, 1}^ x {0, 1}^ for which there 
is a zero-error quantum protocol with 0(N x / 2+e ) qubits 



of communication. Although we suspect that the classical 
zero-error communication complexity of these relations is 
fl(iV), we are only able to prove lower bounds for relations 
derived from 2-level trees: 

Theorem 10 Let g : {0, 1}^ -> {0, 1} be an AND of 

N 1 / 3 ORs of N 2 / 3 variables each. Let R C {0,1}^ x 
{0, 1}^ x {0, 1}^ be the certificate-relation derived from g. 
Then there exists a zero-error 0(N 2 ^ 3 log N)-qubit quan- 
tum protocol for R, whereas, any zero-error classical pro- 
tocol for R needs Cl(N) bits of communication. 

Proof The quantum upper bound follows from Theorem ^ 
and the [^-reduction. 

For the classical lower bound, suppose we have a clas- 
sical zero-error protocol P for R with T bits of commu- 
nication. We will show how we can use this to solve the 
Disjointness problem on k = A fl / 3 (A r2 / 3 — 1) variables. 
(Given Alice's input x e {0, l} fc and Bob's y e {0, l} fc , 
the Disjointness problem is to determine if x and y have a 
1 at the same position somewhere.) Let Q be the following 
classical protocol. Alice and Bob view their fc-bit input as 
made up of N 1 / 3 subtrees of N 2 / 3 — 1 variables each. They 
add a dummy variable with value 1 to each subtree and ap- 
ply a random permutation to each subtree (Alice and Bob 
have to apply the same permutation to a subtree, so we as- 
sume a public coin). Call the iV-bit strings they now have x' 
and y' . Then they apply P to x' and y' . Since f(x', y') = 1, 
after an expected number of 0(T) bits of communication P 
will deliver a certificate which is a common 1 in each sub- 
tree. If one of these common 1 s is non-dummy then Alice 
and Bob output 1, otherwise they output 0. It is easy to see 
that this protocol solves Disjointness with success probabil- 
ity 1 if x A y — and with success probability > 1/2 if 
x A y 7^ 0. It assumes a public coin and uses 0(T) bits 
of communication. Now the well-known Q(k) bound for 
classical bounded-error Disjointness on k variables [ p3| , [34j] 
implies T € fi(fc) = to(N). □ 

The relation of Theorem is "total", in the sense 
that, for every x, y € {0, l} J \there exists a c such that 
(x, y, c) € R. It should be noted that one can trivially con- 
struct a total relation from any partial function by allowing 
any output for inputs that are outside the domain of the func- 
tion. In this manner, a total relation with an exponential 
quantum-classical zero-error gap can be immediately ob- 
tained from the distributed Deutsch-Jozsa problem of [H], 
The total relation of Theorem [h^ is different from this in 
that it is not a trivial extension of a partial function. 

After reading a first version of this paper, Hartmut 
Klauck proved a separation which is the first example of 
a total function with superlinear gap between quantum and 
classical zero-error communication complexity [p5||. Con- 
sider the iterated non-disjointness function: Alice and Bob 



each receive s sets of size n from a size-poly (n) universe 
(so the input length is TV € Q(sn log n) bits), and they have 
to output 1 iff all s pairs of sets intersect. Klauck's function 
/ is an intricate subset of this iterated non-disjointness func- 
tion, but still an explicit and total function. Results of [ pl| ] 
about limited non-deterministic communication complexity 
imply a lower bound for classical zero-error protocols for 
/. On the other hand, because / can be written as a 2-level 
AND-OR-tree, the methods of this paper imply a more ef- 
ficient quantum zero-error protocol. Choosing s = n 5//6 , 
Klauck obtains a polynomial gap: 

Theorem 11 (Klauck [g) For TV E 9(n n / 6 log n) there 
exists a total function f : {0,1}^ x {0,1}^ — > {0,1}, 
such that there is a quantum zero-error protocol for f with 
O(N 10 / 11+e ) qubits of communication (for all e > 0), 
whereas every classical zero-error protocol for f needs 
fi(TV/ log TV) bits of communication. 

7 Quantum complexity of graph properties 

Graph properties form an interesting subset of the set of 
all Boolean functions. Here an input of TV = n(n — 1) bits 
represents the edges of a directed graph on n vertices. (Our 
results hold for properties of directed as well as undirected 
graphs.) A graph property P is a subset of the set of all 
graphs that is closed under permutation of the nodes (so if 
X, Y represent isomorphic graphs, then X E P iff Y G 
P). We are interested in the number of queries of the form 
"is there an edge from node i to node j?" that we need to 
determine for a given graph whether it has a certain property 
P. Since we can view P as a total function on N variables, 
we can use the notations D(P), etc. A property P is evasive 
if D(P) — n{n— 1), so if in the worst case all N edges have 
to be examined. 

The complexity of graph properties has been well- 
studied classically, especially for monotone graph proper- 
ties (a property is monotone if adding edges cannot destroy 
the property). In the sequel, let P stand for a (non-constant) 
monotone graph property. Much research revolved around 
the so-called Aanderaa-Karp-Rosenberg conjecture or eva- 
siveness conjecture, which states that every P is evasive. 
This conjecture is still open; see [ |27| | for an overview. It 
has been proved for n equals a prime power [S], but for 
other n the best known general bound is D(P) E fl(n 2 ) 
[|5j |24]]. (Evasiveness has also been proved for bipar- 
tite graphs [Bit].) For the classical zero-error complexity, 
the best known general result is Rq(P) E f2(n 4 / 3 ) [|l7|], but 
it has been conjectured that Rq(P) E <d(n 2 ). To the best of 
our knowledge, no P is known to have R2(P) G o(n 2 ). 

In this section we examine the complexity of monotone 
graph properties on a quantum computer. First we show that 
if we replace exact classical algorithms by exact quantum 



algorithms, then the evasiveness conjecture fails. However, 
the conjecture does hold up to a constant factor. 

Theorem 12 For all P, Q E {P) G n(n 2 ). There is a P 
such that Qe{P) < n(n — 1) for every n > 2. 

Proof For the lower bound, let deg(f) denote the degree of 
the unique multilinear multivariate polynomial p that rep- 
resents a function / (i.e. p(X) = f(X) for all X). [[| 
proves that Qe(I) > deg(f)/2 for every /. Dodis and 
Khanna @ Theorem 5.1] prove that deg(P) E n(n 2 ) 
for all monotone graph properties P. Combining these two 
facts gives the lower bound. 

Let P be the property "the graph contains more than 
n(n—l)/2 edges". This is just a special case of the Majority 
function. Let / be Majority on N variables. It is known that 
Qe(/) < TV+l-e(TV), where e(TV) is the number of Is in 
the binary expansion of TV. This was first noted by Hayes, 
Kutin and Van Melkebeek jl9[]. It also follows immediately 
from classical results [|8j ]l]] that show that an item with 
the Majority value can be identified classically determinis- 
tically with TV — e(TV) comparisons between bits (a com- 
parison between two black-box-bits is the XOR of two bits, 
which can be computed with 1 quantum query [10|). One 
further query to this item suffices to determine the Majority 
value. For TV = n(n — 1) and n > 2 we have e(TV) > 2 
and hence Qe(I) < TV — e(TV) + 1 < TV. □ 

In the zero-error case, we can show polynomial gaps be- 
tween quantum and classical complexities, so here the eva- 
siveness conjecture fails even if we ignore constant factors. 

Theorem 13 For all P, Qo(P) G f2(n). There is a P such 
thatQ Q (P) E 0(n 3 / 2 ) and R 2 {P) E Vt{n 2 ). 

Proof The quantum lower bound follows from D(P) < 
Qo{P) 2 (Theorem^) and D(P) E &{n 2 ). 

Consider the property "the graph contains a star", where 
a star is a node that has edges to all other nodes. This prop- 
erty corresponds to a 2-level tree, where the first level is an 
OR of n subtrees, and each subtree is an AND of n — 1 vari- 
ables. The n — 1 variables in the ith subtree correspond to 
the n— 1 edges for j 7^ i. The ith subtree is 1 iff the ith 
node is the center of a star, so the root of the tree is 1 iff the 
graph contains a star. Now we can show Qo(P) E 0(n 3 / 2 ) 
and R2(P) G Q(n 2 ) analogously to Theorem ^[ □ 

Combined with the translation of a quantum algorithm 
to a polynomial [S], this theorem shows that a "zero-error 
polynomial" for the STAR-graph property can have degree 
0(n 3 / 2 ). Thus proving a general lower bound on zero-error 
polynomials for graph properties will not improve Hajnal's 
randomized lower bound of n 4 / 3 further then v?l 2 . In par- 
ticular, a proof that Rq(P) E ft(n 2 ) cannot be obtained 



via a lower bound on degrees of polynomials. This con- 
trasts with the case of exact computation, where the S7(n 2 ) 
lower bound on deg(P) implies both D(P) G il(n 2 ) and 
Q E (P)en(n 2 ). ' 

Finally, for the bounded-error case we have quadratic 
gaps between quantum and classical: the property "the 
graph has at least one edge" has Q2 (P) G 0(n) by Graver's 
quantum search algorithm. Combining that D(P) G ft(n 2 ) 
for aU P and D(f) G 0(Q 2 (/) 4 ) for all monotone / [g], 
we also obtain a general lower bound: 

Theorem 14 For all P, we have Qz{P) G fl(^/n). There 
is a P such that Q%(P) G 0(n). 
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A Proof of Theorem |2| 

Here we prove a lower bound on small-error quantum 
search. The key lemma of ^ gives the following relation 
between a T-query network and a polynomial that expresses 
its acceptance probability as a function of the input X (such 
a relation is also implicit in some of the proofs of [ p"4] , pj[]): 

Lemma 2 The acceptance probability of a quantum net- 
work that makes T queries to a black-box X, can be written 
as a real-valued multilinear N-variate polynomial P(X) of 
degree at most IT. 

An iV-variate polynomial P of degree d can be reduced 
to a single- variate one in the following way (due to p8|]). 
Let the symmetrization p s v m be the average of P over all 
permutations of its input: 



psym j s m 7V-variate polynomial of degree at most d. It 
can be shown that there is a single-variate polynomial Q of 
degree at most d, such that P s v m (X) = Q(\X\) for all X G 
{0, 1}^. Here \X\ denotes the Hamming weight (number 
of Is) of X. 

Note that a quantum search algorithm A can be used to 
compute the OR-function of X (i.e. decide whether X con- 
tains at least one 1): we let A return some j and then we 
output the bit Xj. If OR(X) = 0, then we give the cor- 
rect answer with certainty; if OR(X) = 1 then the proba- 
bility of error e is the same as for A. Rather than proving a 
lower bound on search directly, we will prove a lower bound 
on computing the OR-function; this clearly implies a lower 
bound for search. The main idea of the proof is the follow- 
ing. By Lemma |[ the acceptance probability of a quantum 
computer with T queries that computes the OR with error 
probability < e (under the promise that there are either or 
at least t solutions) can be written as a multivariate polyno- 
mial P of degree < 2T of the N bits of X. This polynomial 
has the properties that 

p(o) = qQ 

1 - £ < P{X) < 1 whenever \X\ e [t, N] 

By symmetrizing, P can be reduced to a single-variate poly- 
nomial s of degree d < 2T with the following properties: 

s(0) = 

1 — e < s(x) < 1 for all integers x £ [t, N] 

We will prove a lower bound on e in terms of d. Since 
d < 2T, this will imply a lower bound on e in terms of T. 
Our proof uses three results about polynomials. The first 
gives a general bound for polynomials that are bounded by 
1 at integer points [jll p. 980]: 

Theorem 15 (Coppersmith & Rivlin) For every polyno- 
mial p of degree d that has absolute value 

\p{ x )\ < 1 for all integers x S [0, n], 

we have 

\p(x)\ < ae bd2/n for all real x G [0,n], 
where a, b > are universal constants. (No explicit values 



for a and b are given in [11 ].) 



The second two tools concern the Chebyshev polynomi- 
als T d , defined as [51: 



T d {x) 



x 2 - 1 



- Vx 2 - 1 



An 



1 Since we can always test whether we actually found a solution at the 
expense of one more query, we can assume the algorithm always gives the 
right answer 'no' if the input contains only 0s. Hence s(0) = 0. However, 
our results remain unaffected up to constant factors if we also allow a small 
error here (i.e. < s(0) < e). 



T d has degree d and its absolute value |Td(a;)| is bounded 
by 1 if a; G [—1,1]. Among all polynomials with those 
two properties, T d grows fastest on the interval [1, oo) ([f3(| 
p.l08]and[|2[Fact2]): 

Theorem 16 If q is a polynomial of degree d such that 
\q(x)\ < 1 for all x G [-1,1] then \q(x)\ < \T d (x)\ for 
all x > 1. 

Paturi ([[32| before Fact 2] and personal communication) 
proved 



Rearranging gives the bound. 



□ 



Lemma 3 (Paturi) T d (l + fi) < e 2 ^ 2 ^ 2 for all fj, > 0. 



Proof For x = 1 + /i: T d (x) < (x + \/ x 2 - if 

{l + l i+ y /2» + f) d < (1 + 2^2,1 + M 2 ) d < e 2d V^ 
□ 



Now we can prove: 

Theorem 17 Lef 1 < t < N be an integer. Every poly- 
nomial s of degree d < N — t such that s(0) = and 
1 — e < s(x) < lfor all integers x G [£, A] /zas 



e > }_ e -bd 2 /(N-t)-Ad^ftN/{N-tY j 

— a 

w/zere a, 6 are as in Theorem |/5] 

Proof A polynomial p with p(0) = and p(a;) = 1 for all 
integers a; G [t, N] must have degree > N — t. Since d < 
N — t for our s, we have e > 0. Now p(x) = 1 — s(N — x) 
has degree d and 

< p(x) < e for all integers x E [0, N — t] 

p(N) = 1 

Applying Theorem |l5] to p/e (which is bounded by 1 at 
integer points) with n = N — t we obtain: 

\p(x)\ < eae bd2/{N - t) for all real x g [0,N-t\. 

Now we rescale p to q(x) = p{{x + l)(N — t)/2) (i.e. the 
domain [0, N — t] is transformed to [—1, 1]), which has the 
following properties: 

\q(x)\ < eae bd2 ^ N - t) for all real a; G [-1,1] 
q(l +fi)= p(N) = 1 for /i = 2t/(N - t). 

Thus q is "small" on all x G [—1, 1] and "big" somewhere 
outside this interval {q(l + p) = 1). Linking this with The- 
orem [l6| and Lemma || we obtain 

1 = q(l + n) 

< sae bd2 /^\T d (l + p)\ 

< £ae bd2 /(N-t) e 2d^/2^+u, 2 

= £ae M2/(Ar ~ t)+2d V 4t/(Ar - t)+4t2/(Af -- t)2 

= £ae bd 2 /(N-t)+±d^tN/(N-ty _ 



Since a quantum search algorithm with T queries in- 
duces a polynomial s with the properties mentioned in The- 
orem and d < 2T, we obtain the following bound for 
quantum search under the promise (if T < N — t, then 

£ > 0): 

Theorem § Under the promise that the number of solutions 
is at least t, every quantum search algorithm that uses T < 
N — t queries has error probability 



-4bT 2 /(N-t)-8Ty/tN/(N-t) 2S 



B Proof of Lemma || 

Lemma |j] Let d > 1 and let / denote the uniform e?-level 
AND-OR tree on N variables that has an OR as root. There 
exists a quantum algorithm A± that finds a 1 -certificate in 
expected number of queries 0(N 1 / 2+1 / 2d ) if f{X) = 1 
and does not terminate if f(X) = 0. Similarly, there ex- 
ists a quantum algorithm that finds a 0-certificate in ex- 
pected number of queries 0(A 1 / 2+1 / d ) if f(X) = and 
does not terminate if f(X) = 1. 

Proof By induction on d. 

Base step. For d = 1 the bounds are trivial. 
Induction step (assume the lemma for d — 1). Let / 

be the uniform d-level AND-OR tree on N variables. The 
root is an OR of A^ 1 ^ subtrees, each of which has N l - d ~ 1 ^ d 
variables. 

We construct A\ as follows. First use multi-level 
Grover-search as in ^ Theorem 1.15] to find a subtree 
of the root whose value is 1, if there is one. This takes 
queries and works with bounded- 
error. By the induction hypothesis there exists an algorithm 
A' with expected number of 0((Ar(<*-i)/d)i/2+i/(d-i)) = 
0(N 1 / 2 + 1 / 2d ) queries that finds a 1 -certificate for this sub- 
tree (note that the subtree has an AND as root, so the 
roles of and 1 are reversed). If A' has not termi- 
nated after, say, 10 times its expected number of queries, 
then terminate it and start all over with the multi-level 
Grover search. The expected number of queries for one 
such run is OiN 1 ^ 2 (log N)^ 1 ) + 10 • 0{N l l 2+1 ' 2d ) = 
0(^1/2+1/2^ If = L ±en ^ expected num- 

ber of runs before success is 0(1) and Ai will find a 1- 
certificate after a total expected number of 0(N 1 / 2+1/>2d ) 
queries. If f(X) = 0, then the subtree found by the multi- 
level Grover-search will have value 0, so then A' will never 
terminate by itself and A\ will start over again and again 
but never terminates. 

We construct Aq as follows. By the induction hypoth- 
esis there exists an algorithm A[ with expected number 



of 0((jv(«'- 1 )/'') 1 /2+V2(«i-i)) = 0(7VV2) queries that 
finds a O-certificate for a subtree whose value is 0, and 
that runs forever if the subtree has value 1 . A n first runs 
A[ on the first subtree until it terminates, then on the sec- 
ond subtree, etc. If f(X) = 0, then each run of A[ will 
eventually terminate with a O-certificate for a subtree, and 
the O-certificates of the N x / d subtrees together form a 0- 
certificate for /. The total expected number of queries is 
the sum of the expectations over all N 1 ^ subtrees, which is 
. 0{N^ 2 ) = 0{N 1 l 2+1 / d ). If f(X) = 1, then one 
of the subtrees has value 1 and the run of A[ on that subtree 
will not terminate, so then A will not terminate. □ 



